Academy LMS CVE-2026-120544

Requires an authenticated WordPress account at contributor level or above on a site running Academy LMS 4.0.1 or earlier (per CVSS PR:L); self-service registration of such accounts, where enabled, lowers this bar. Exploitation targets the REST endpoint backed by the plugin's block.php template handler by placing a directory-traversal sequence in the 'id' parameter. A key limiting factor built into the vulnerable code constrains impact: the plugin appends a '.html' extension to the attacker-supplied path before reading, so only files ending in .html are disclosable - wp-config.php, .php source, and all non-.html files are unreachable, substantially narrowing the sensitive data an attacker can obtain.

This is a moderate, not urgent, issue. The CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) reflects a network-reachable but privilege-gated information disclosure: the vector's PR:L maps to the description's requirement for contributor-level access or above, so this is an authenticated flaw, not a pre-auth one. The real-world impact is further constrained by mechanism - the plugin hard-appends a '.html' extension, so confidentiality impact is C:L (only arbitrary .html files are readable; high-value targets like wp-config.php are explicitly out of reach), with no integrity or availability impact. No EPSS score, KEV listing, or PoC/exploit reference is present in the input, and the vuln.today decision label is 'this_month' rather than 'act_now' or 'emergency', so exploitation signals point to low urgency. Caveat on missing data: EPSS exploitation probability is absent from the input and cannot be weighed, and there is no SSVC automatability/technical-impact breakdown to cross-reference - the priority rests on the CVSS vector, the limited .html-only impact, and the authenticated precondition, all of which are consistent with each other.

An attacker who holds (or registers/compromises) a contributor-level WordPress account sends a crafted REST request supplying a directory-traversal path in the 'id' parameter, causing the plugin to read a chosen .html file from outside the intended directory and return its full contents in the REST JSON response's content field. Because a '.html' extension is appended to the supplied path, the attacker can only reach .html files, not source or config files. No public exploit code is identified in the available data.